Host Proxy for Suppressing Broadcast Traffic in Virtual Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Broadcast traffic in networks, particularly in virtual layer 2 networks, leads to scalability and security issues due to high resource consumption and vulnerability to attacks like ARP poisoning, as protocols like ARP and DHCP rely on broadcast messages that are not designed with security in mind, causing performance decrements and increased workload on routers.
Innovation Solution
Implementing proxies on host devices to intercept and manage broadcast packets, converting them into unicast messages using a directory service that maintains global network information, thereby reducing the need for broadcast transmissions and enhancing security through encrypted connections.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If broadcast traffic is used for ARP and DHCP protocols, then all hosts within a broadcast domain can receive network configuration information, but resource consumption increases linearly with the number of hosts and security vulnerabilities arise
Solution Approach 1:
The patent introduces a gateway device as an intermediary between hosts and the network. The gateway intercepts broadcast packets (ARP, DHCP) before they are sent to all hosts, processes them unicast-style by querying a directory service, and returns responses individually. This mediator approach maintains broadcast domain functionality while eliminating the resource consumption of traditional broadcast traffic.
2Ease of operation
If broadcast traffic is used for ARP and DHCP protocols, then network configuration can be distributed to all hosts, but security vulnerabilities increase due to lack of authentication mechanisms
Solution Approach 1:
The gateway acts as a trusted intermediary that implements secure authentication mechanisms. Instead of relying on unauthenticated broadcast protocols, the gateway verifies host identities through directory service queries before providing network configuration information, thereby eliminating ARP poisoning and spoofing vulnerabilities while maintaining ease of configuration distribution.
Solution Approach 2:
The system uses existing directory services (LDAP, Active Directory) that hosts can query directly for network configuration information. This self-service approach eliminates the need for vulnerable broadcast-based ARP and DHCP protocols, as hosts can obtain configuration information on-demand through secure directory service authentication.
3Adaptability or versatility
If layer 3 multicast is used to send broadcast packets across subnets, then virtual networks can span multiple subnets, but router workload becomes very high when the number of multicast groups is large
Solution Approach 1:
The gateway serves as an intermediary that handles all broadcast traffic locally without requiring multicast routing across subnets. By processing ARP and DHCP requests unicast-style through directory service queries, the gateway eliminates the need for routers to maintain multicast group state, thereby enabling virtual networks to span multiple subnets without increasing router workload.
4Adaptability or versatility
If unicast approach is used to send broadcast packets to each host individually, then broadcast traffic can be sent across subnets, but computation resources at the source entity and bandwidth resources at the physical network are consumed
Solution Approach 1:
The gateway acts as a centralized intermediary that consolidates all broadcast traffic handling. Instead of having each host send individual unicast packets across subnets, the gateway processes all ARP and DHCP requests locally through efficient directory service queries, dramatically reducing both computation resources at source entities and bandwidth consumption on physical networks while maintaining cross-subnet virtual network functionality.
Data Source
AI summary
Some embodiments use proxies on host devices to suppress broadcast traffic in a network. Each host in some embodiments executes one or more virtual machines (VMs). In some embodiments, a proxy operates on each host between each VM and the underlying network. For instance, in some of these embodiments, a VM's proxy operates between the VM and a physical forwarding element executing on the VM's host. The proxy monitors the VM's traffic, and intercepts broadcast packets when it knows how to deal with them. The proxy connects to a set of one or more controllers that provides a directory service that collects and maintains global information of the network. By connecting to the controller cluster, the proxy can obtain information that it can use to resolve broadcast requests. In some embodiments, the connection between the proxy and the controller cluster is encrypted and authenticated, to enhance the security. Also, in some embodiments, the connection is an indirect connection through an agent that executes on the host device and connects the proxies of the host device with the controller cluster.